Lucene search

[email protected]CVE-2023-35871

HistoryJul 11, 2023 - 3:15 a.m.

CVE-2023-35871

2023-07-1103:15:09

CWE-787

[email protected]

web.nvd.nist.gov

sap

web dispatcher

version

vulnerability

memory corruption

information disclosure

system crashes

nvd

cve-2023-35871

9.4 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

LOW

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:H

8.9 High

AI Score

Confidence

High

0.001 Low

EPSS

Percentile

32.6%

JSON

The SAP Web Dispatcher - versions WEBDISP 7.53, WEBDISP 7.54, WEBDISP 7.77, WEBDISP 7.85, WEBDISP 7.89, WEBDISP 7.91, WEBDISP 7.92, WEBDISP 7.93, KERNEL 7.53, KERNEL 7.54 KERNEL 7.77, KERNEL 7.85, KERNEL 7.89, KERNEL 7.91, KERNEL 7.92, KERNEL 7.93, KRNL64UC 7.53, HDB 2.00, XS_ADVANCED_RUNTIME 1.00, SAP_EXTENDED_APP_SERVICES 1, has a vulnerability that can be exploited by an unauthenticated attacker to cause memory corruption through logical errors in memory management this may leads to information disclosure or system crashes, which can have low impact on confidentiality and high impact on the integrity and availability of the system.

Affected configurations

NVD

Node

sapweb_dispatcherMatch7.53

sapweb_dispatcherMatch7.54

sapweb_dispatcherMatch7.77

sapweb_dispatcherMatch7.85

sapweb_dispatcherMatch7.89

sapweb_dispatcherMatch7.91

sapweb_dispatcherMatch7.92

sapweb_dispatcherMatch7.93

sapweb_dispatcherMatchhdb_2.00

sapweb_dispatcherMatchkernel_7.53

sapweb_dispatcherMatchkernel_7.54

sapweb_dispatcherMatchkernel_7.77

sapweb_dispatcherMatchkernel_7.85

sapweb_dispatcherMatchkernel_7.89

sapweb_dispatcherMatchkernel_7.91

sapweb_dispatcherMatchkernel_7.92

sapweb_dispatcherMatchkernel_7.93

sapweb_dispatcherMatchkrnl64uc_7.53

sapweb_dispatcherMatchsap_extended_app_services_1

sapweb_dispatcherMatchxs_advanced_runtime_1.00

CPENameOperatorVersion
sap:web_dispatchersap web dispatchereq7.53
sap:web_dispatchersap web dispatchereq7.54
sap:web_dispatchersap web dispatchereq7.77
sap:web_dispatchersap web dispatchereq7.85
sap:web_dispatchersap web dispatchereq7.89
sap:web_dispatchersap web dispatchereq7.91
sap:web_dispatchersap web dispatchereq7.92
sap:web_dispatchersap web dispatchereq7.93
sap:web_dispatchersap web dispatchereqhdb_2.00
sap:web_dispatchersap web dispatchereqkernel_7.53

CPE	Name	Operator	Version
sap:web_dispatcher	sap web dispatcher	eq	7.53
sap:web_dispatcher	sap web dispatcher	eq	7.54
sap:web_dispatcher	sap web dispatcher	eq	7.77
sap:web_dispatcher	sap web dispatcher	eq	7.85
sap:web_dispatcher	sap web dispatcher	eq	7.89
sap:web_dispatcher	sap web dispatcher	eq	7.91
sap:web_dispatcher	sap web dispatcher	eq	7.92
sap:web_dispatcher	sap web dispatcher	eq	7.93
sap:web_dispatcher	sap web dispatcher	eq	hdb_2.00
sap:web_dispatcher	sap web dispatcher	eq	kernel_7.53

Rows per page:

1-10 of 201

CNA Affected

[
  {
    "defaultStatus": "unaffected",
    "product": "SAP Web Dispatcher",
    "vendor": "SAP_SE",
    "versions": [
      {
        "status": "affected",
        "version": "WEBDISP 7.53"
      },
      {
        "status": "affected",
        "version": "WEBDISP 7.54"
      },
      {
        "status": "affected",
        "version": "WEBDISP 7.77"
      },
      {
        "status": "affected",
        "version": "WEBDISP 7.85"
      },
      {
        "status": "affected",
        "version": "WEBDISP 7.89"
      },
      {
        "status": "affected",
        "version": "WEBDISP 7.91"
      },
      {
        "status": "affected",
        "version": "WEBDISP 7.92"
      },
      {
        "status": "affected",
        "version": "WEBDISP 7.93"
      },
      {
        "status": "affected",
        "version": "KERNEL 7.53"
      },
      {
        "status": "affected",
        "version": "KERNEL 7.54 KERNEL 7.77"
      },
      {
        "status": "affected",
        "version": "KERNEL 7.85"
      },
      {
        "status": "affected",
        "version": "KERNEL 7.89"
      },
      {
        "status": "affected",
        "version": "KERNEL 7.91"
      },
      {
        "status": "affected",
        "version": "KERNEL 7.92"
      },
      {
        "status": "affected",
        "version": "KERNEL 7.93"
      },
      {
        "status": "affected",
        "version": "KRNL64UC 7.53"
      },
      {
        "status": "affected",
        "version": "HDB 2.00"
      },
      {
        "status": "affected",
        "version": "XS_ADVANCED_RUNTIME 1.00"
      },
      {
        "status": "affected",
        "version": "SAP_EXTENDED_APP_SERVICES 1"
      }
    ]
  }
]

References

me.sap.com/notes/3340735

www.sap.com/documents/2022/02/fa865ea4-167e-0010-bca6-c68f7e60039b.html

9.4 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

LOW

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:H

8.9 High

AI Score

Confidence

High

0.001 Low

EPSS

Percentile

32.6%

JSON

Related for CVE-2023-35871

cvelist1 prion1 nvd1